Skip to main content

API

Kong terminates the public prefix. Upstream paths below do not include /api.

  • Conversations, messages, reactions, pins, read and delivered acks, search, unread count.
  • POST /v1/messaging/ws-ticket then WebSocket /v1/messaging/ws.
  • Presence bulk and group member admin routes.
  • Internal conversation, membership, unread, and presence endpoints.

The HTTP contract is OpenAPI. When a route changes, update splick-backend/openapi/openapi.yaml in the same change as the controller.

Auth​

  • Public user routes expect a bearer access token issued by auth-service. Kong does not validate the JWT.
  • Service-to-service routes use INTERNAL_API_KEY. Do not document or commit the value.
  • Rate limits for auth-sensitive routes are declared per route in splick-backend/infra/kong/kong.yml.